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Preface 



The Department of Homeland Security (DHS) Office of Inspector General (OIG) was 
established by the Homeland Security Act of 2002 (Public Law 107-296) by amendment 
to the Inspector General Act of '1978. This is one of a series of audit, inspection, and 
special reports prepared as part of our oversight responsibilities to promote economy, 
efficiency, and effectiveness within the department. 

This report addresses the strengths and weaknesses of the Office of Operations 
Coordination and Planning' s National Operations Center. It is based on interviews with 
employees and officials of relevant agencies and institutions, direct observations, and a 
review of applicable documents. 

The recommendations herein have been developed to the best knowledge available to our 
office, and have been discussed in draft with those responsible for implementation. We 
trust this report will result in more effective, efficient, and economical operations. We 
express our appreciation to all of those who contributed to the preparation of this report. 




Richard L. Skinner 
Inspector General 
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Department of Homeland Security 
Office of Inspector General 
Executive Summary 

At the request of U.S. Representative Bennie G. Thompson, Chairman of 
the House Committee on Homeland Security, we reviewed information 
sharing processes at the Department of Homeland Security's National 
Operations Center. We focused on the functional and organizational 
changes the department has made to the National Operations Center, since 
Hurricane Katrina, to manage the flow of information better. Specifically, 
we assessed whether: (1) procedures instituted ensure that incoming 
reports are appropriately directed within the center; (2) information is 
reviewed and disseminated timely to key department officials; and (3) 
information is coordinated efficiently and effectively with other federal, 
state, and local governmental partners that have a role in response 
operations. 

Within the department, the Office of Operations Coordination and 
Planning oversees the National Operations Center and has made numerous 
improvements to the center's information sharing capabilities since 
Hurricane Katrina. These improvements include the development and 
implementation of the operational phase and notification systems, and 
increased involvement in working groups and coordination meetings. 

Despite these improvements, a number of barriers hinder the flow of 
information. Organizational, administrative, infrastructure, information 
technology, and staffing obstacles continue to affect information sharing at 
the National Operations Center adversely. 

Our report addresses information sharing and collaboration changes at the 
National Operations Center from Hurricane Katrina' s August 2005 
landfall to completion of our fieldwork in April 2009. We are making 17 
recommendations to assist the Office of Operations Coordination and 
Planning in improving the information sharing capabilities of the National 
Operations Center. In response to our report, the Office of Operations 
Coordination and Planning has proposed plans and taken action that, once 
fully implemented, will enhance the follow of information. The 
department concurred with all 17 recommendations. 
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Background 



The federal government received widespread criticism for a slow and 
ineffective response to Hurricane Katrina. In February 2006, after an 
extensive evaluation of the federal government's response, the White 
House released its report, The Federal Response to Hurricane Katrina: 
Lessons Learned. The report, the product of a review by the President's 
Homeland Security Advisor, outlined numerous failings in emergency 
preparedness and response and made 125 recommendations to the 
President. 

The report concluded that the Department of Homeland Security (DHS) 
needed both the requisite headquarters management institutions and 
sufficient field capabilities to organize a successful federal response effort. 
According to the report, it was essential to strengthen DHS' headquarters 
elements to direct the federal response, while also providing appropriate 
resources to DHS field elements for more effective ground response efforts. 

Recommendations of the White House Report 

To achieve these goals, one recommendation in the report called 
for DHS to create a new organizational structure, or National 
Operations Center (NOC), to coordinate and integrate the national 
response and provide a Common Operating Picture for the entire 
federal government. 1 Another recommendation was that the NOC 
should combine, co-locate, and replace the situational awareness 
mission of DHS' Homeland Security Operations Center, the 
operational mission of its National Response Coordination Center 
(NRCC), and the role of the Interagency Incident Management 
Group. Also, the NOC should be staffed with full-time detailed 
employees assigned to a planning cell from relevant federal, state, 
and local departments and agencies. 

Prior to Hurricane Katrina, DHS' Homeland Security Operations 
Center served as the Nation's nerve center for information sharing 
and domestic incident management, increasing coordination 
between federal, state, territorial, tribal and local governments, and 
the private sector. The NRCC handled overall federal response 
coordination for incidents of national significance and 
implemented emergency management programs. The Interagency 
Incident Management Group was responsible for strategic 



1 Common Operating Picture is a shared display of relevant and operational information (e.g., the position 
of resources and status of important infrastructure such as bridges, roads, etc.) that facilitates collaborative 
planning and assists all in achieving situational awareness of an event. 
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interagency-level coordination and worked to resolve resource 
conflicts unresolved by the NRCC. 

The White House report included three additional 
recommendations intended to improve information sharing and 
enhance the information reporting system. 

• Recommendation 16 called for a national information and 
knowledge management system for all departments and 
agencies working with the NOC to provide a Common 
Operating Picture that allows for the processing and timely 
provisioning of interagency information sources. 

• Recommendation 17 required the creation of a single or 
national reporting system by departments and agencies 
working with the NOC in order to establish uniform 
information flow to senior decision makers. 

• Recommendation 1 8 described the establishment of 
national information requirements and a national reporting 
chain to ensure both that accurate information is reported in 
a timely manner and that there is standard information flow 
through all levels of the incident command structure. 

We used a number of recommendations in the White House report 
as a baseline to determine DHS' progress in making functional and 
organizational changes to the NOC since Hurricane Katrina. 

Office of Operations Coordination and Planning and the 
Creation of the National Operations Center 

DHS' Office of Operations Coordination and Planning (OPS) is 
responsible for monitoring the daily security of the United States. 
It does so by coordinating activities within DHS, with state 
governors, Homeland Security Advisors, law enforcement 
partners, and with critical infrastructure operators in all 50 states. 
Among its duties, OPS is responsible for overseeing the NOC, 
conducting joint operations across all organizational elements, 
coordinating activities related to incident management, and 
employing all DHS resources to translate intelligence and policy 
into action. 

The NOC was officially established on May 25, 2006. Its mission 
is to facilitate information sharing and operational coordination 
with other federal, state, local, tribal, non-governmental, and 
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private sector agencies, as well as to provide situation awareness to 
senior DHS and White House leadership. The NOC accomplishes 
its mission through a network of coordination elements that 
provide domestic situational awareness, a Common Operating 
Picture, information fusion, information sharing, communications, 
and coordination pertaining to domestic incident management and 
the prevention of terrorism. 

The National Operation Center and Its Elements 

The NOC operates 24 hours a day, 7 days a week, 365 days a year, 
and it collects and fuses information from more than 35 federal, 
state, local, tribal, non-governmental, and private sector agencies. 
The NOC is composed of five elements — Watch, Intelligence 
Watch and Warning, NRCC, the National Infrastructure 
Coordinating Center (NICC), and the Planning Element, as shown 
in Figure 1 . 



2 Information fusion is the process of managing the flow of information and intelligence across all levels 
and sectors of government and private industry, and through analysis, creating meaningful intelligence 
products. 
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Fianre 1 : Elements nf the NOC 



Although the NRCC, NICC, and Intelligence Watch and Warning 
are elements of the NOC, they remain independent entities under 
the tactical, operational, and program management control of their 
DHS components, the Federal Emergency Management Agency, 
the National Protection and Programs Directorate, and the Office 
of Intelligence and Analysis (I&A), respectively. 
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National Operations Center Watch Officers' Duties and 



Responsibilities 



The NOC Watch is the center of operations, and information is 
communicated through it to the other elements. The NOC Watch is 
staffed on weekdays and 

on weekends. Relieving personnel report to duty before 
their shift to establish situational awareness 

The NOC Watch is manned by watch officers including the Senior 
Watch Officer (SWO), Assistant Senior Watch Officer (ASWO), 
Communications Watch Officer, Knowledge Management Officer, 
Incident Management Officer, Tracker, and other agency desk 
officers. Appendix C lists NOC Watch participants. 

The SWOs supervise the activities of the NOC. 

The 

SWOs brief the NOC Director, DHS' Secretary, Deputy Secretary, 
and Chiefs of Staff on potential or actual incidents, both domestic 
and international, that may affect national security. 

The ASWOs serve as the SWOs' executive watch officers. They 
keep a log of events, assist the SWOs in their duties, and act 
on the SWOs' behalf when the SWOs are absent from the NOC. 
The Communications Watch Officer applies technical expertise 
and facilitates communications 

The Knowledge Management Officer prepares 
visual display schemes and posts relevant information 

The Incident 

Management Officer finds vetted sources and distills information 

The Tracker 

monitors intelligence threats or incidents 

A number of desk officers are detailed to the NOC from DHS 
components and other federal agencies. Desk officers provide 
subject matter expertise and liaise with agency officials and other 
watch centers to collect valuable information. 

In fall 2008, the NOC underwent reorganization. Several SWO 
and ASWO positions are now staffed by DHS component detailees 
serving 2-year assignments, and the NOC reimburses their salaries. 
Before the reorganization, the SWO and ASWO positions were 
staffed entirely by full-time government employees hired on a 
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permanent basis; individuals formerly serving in these positions 
have found new positions within DHS or have left the department. 

Operations and Intelligence Sides of the National Operations 
Center 

The NOC is divided into two sections, the Operations Side and the 
Intelligence Side. These sections function in tandem, 

and share 

information. Both sections are on the same floor; however, a wall 
separates the sections; 



The Operations Side tracks emergency management and law 
enforcement activities across the country that may affect national 
security. 

The SWO is located 

on the Operations Side, along with the DHS component desks and 
state and local law enforcement officers. 

The Intelligence Side focuses on classified intelligence and uses 
that information in support of emergency management and law 
enforcement activities. 

The Intelligence Side consists of the 
Senior Intelligence Analysts, Intelligence Analysts, the Intelligence 
Watch and Warning branch of the NOC, and the U.S. Secret 
Service desk officers. 
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Information Sharing Platforms at the National Operations 



Center 



The NOC maintains situational awareness through shared 
programs such as the Homeland Security Information Network 
(HSIN). HSIN is a comprehensive web-based platform that 
facilitates real-time Sensitive But Unclassified information sharing 
and collaboration with federal, state, local, tribal, private sector, 
and international partners. HSIN also hosts the Common 
Operating Picture and provides situational awareness and analysis 
of emerging events to state and local officials, and across the 
federal government. 

As part of the Common Operating Picture, NOC officials can post 
valuable information, such as situation reports and technical data 
regarding unfolding events or recovery efforts. NOC products 
such as NOC Notes and Situation Reports provide detailed real- 
time information to NOC partners. By using these products, 
interested parties can access reports and other detailed information 
such as statistics and interactive maps. 

Results of Review 

OPS has made numerous improvements to information sharing capabilities at the 
NOC since Hurricane Katrina. However, a number of barriers hinder the effective 
and efficient flow of information. Organizational, administrative, infrastructure, 
information technology (IT), and staffing obstacles continue to affect information 
sharing and collaboration at the NOC adversely. Although NOC officials and 
managers acknowledge most of these barriers, they have made limited progress in 
correcting the challenges. However, NOC officials are committed to mitigating 
or eliminating obstacles that limit the NOC's effectiveness, or ability to fulfill its 
mission. 

The National Operations Center Has Improved Its Information 
Sharing Capabilities Since Hurricane Katrina 

The NOC has made numerous improvements to its information sharing 
capabilities since Hurricane Katrina. Improvements include the 
operational phase and notification systems, and an increased involvement 
of NOC management in working groups and coordination meetings. As a 
result of these improvements, NOC managers are able to process 
information and distribute it to key decision makers better. 
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The National Operations Center Now Operates Under an 



Operational Phase System 



During Hurricane Katrina, the NOC's operational phase system did 
not exist. As of February 2007, the NOC 

respond to time-sensitive 
incidents in a decisive manner depending on severity. Before the 
operational phase system was implemented, a NOC official said 
that when events occurred, there was no level of severity 
associated with an incident. Now there are "key actions" that must 
be performed once a certain threshold of severity is reached. This 
official added that NOC management developed the 
system, 



Figure 2: NOC Operational Phases 



These phases correspond to the NOC Director's Criteria, which 
represent a list of increasingly severe events that are thresholds for 
the NOC to transition to increased operational postures. The 
Director's Criteria range from routine national and international 
events that may be of interest to DHS officials, to events so severe 
or catastrophic that the federal government must assume the 
highest operational level. During each operational phase, the NOC 
performs a set of key actions and develops deliverables 
collectively aimed at target audiences. 
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Figure 3: NOC Operational Phase System 
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The National Operations Center's Notification System Has 
Been Enhanced 

To ensure DHS leadership's awareness of emerging events and 
domestic threats, the NOC has updated its notification system 



The SWO, along with NOC leadership, uses the information 
obtained to determine the appropriate 

NOC phase. 
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Figure 4: NOC Notification Sequence of Key Actions 



To determine whether NOC officials disseminated relevant, useful, 
and timely information to key department officials, we reviewed 
six past events reported to the NOC. The events, which occurred 
from August 2006 to February 2008, represent the type and variety 
of incidents faced by an all-hazards operations center such as the 
NOC. These events involved information sharing and operational 
coordination with multiple DHS components and external 
agencies, and had implications for a broad spectrum of national 
security concerns. The events also involved emergency 
management efforts and an incident involving the biological 
warfare agent ricin. 5 

Event One: Threat to Commercial Aircraft 

In August 2006, a terrorist plot was uncovered in which several 
individuals planned to detonate liquid explosives carried onboard 
several commercial aircraft traveling from the United Kingdom to 
the United States and Canada. Efforts to disrupt this plot involved 
valuable intelligence gathering, surveillance, and the eventual 
arrests of multiple conspirators by British law enforcement. 



3 T = Time when incident was reported to the NOC. T+ indicates the number of minutes from the initial 
report to the time a key action should be completed. 

4 The Crisis Action Team is activated to take on the responsibilities of the NOC Watch during a phase 2 or 
phase 3 event or threat. The Crisis Action Team prepares executive summaries, situation reports, and other 
briefing products, responds to requests for information, and frames the courses of action and policy 
decisions to facilitate the DHS Secretary's informed interaction with DHS principals and interagency peers. 

5 Ricin is a toxin created from the waste of processed castor beans that can be weaponized as a powder, 
spray, or pellet. It is highly poisonous; a dose the size of a pinhead (approximately 0.5 milligrams) can kill 
an adult. 
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Event Two: Drug-Resistant Strain of Tuberculosis 

In May 2007, a U.S. Customs and Border Protection (CBP) 
Inspector allowed an individual infected with a drug-resistant 
strain of tuberculosis to cross the border into the United States 
from Canada. 



Event Three: Threat to Petroleum Pipelines at John F. Kennedy 
International Airport 

In June 2007, a joint investigation by the New York City Police 
Department, the Federal Bureau of Investigation (FBI), and the 
New York City Port Authority resulted in the arrests of four 
individuals plotting to attack John F. Kennedy International 
Airport by planting explosives on the airport's jet fuel supply tanks 
and pipelines. 

Event Four: Wildfires in Southern California 

In October 2007, state and federal emergency responders battled a 
series of wildfires in Southern California that affected seven 
counties and resulted in extensive damage and mass evacuations. 
Drought, hot weather, and strong Santa Ana winds fueled these 
fires. 

Event Five: Power Outage in Miami, Florida 

In February 2008, a failed switch and fire at an electrical substation 
resulted in widespread blackouts throughout much of South 
Florida, including all of Miami, and reached as far as Tampa and 
Orlando. 

Event Six: Ricin Incident in Las Vegas, Nevada 

In February 2008, law enforcement and emergency responders 
were called to a Las Vegas hotel, where a guest had contacted 
authorities to report he was suffering from respiratory distress. 
Upon entering the hotel room, emergency personnel discovered a 
substance that was later determined to be ricin. 



6 Santa Ana winds are dry and warm, often hot winds in the Southern California area that blow in from the 
desert. 
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Figure 5 lists the selected events, corresponding date, highest NOC 
phase determination, and the number of minutes required to post 
the initial phase notification to HSIN. 

Figure 5: NOC Selected Events for Review 



The threat to commercial aircraft from London to the United States 
and the aircraft passenger with tuberculosis occurred before the 
NOC's use of the phased notification system. Figure 6 shows that, 
with the exception of the John F. Kennedy pipeline incident, NOC 
personnel did not meet their established notification requirements, 
but our analysis revealed that information did get to key decision 
makers in a timely manner for all six events. For example, during 
the Southern California wildfires, DHS' Secretary requested that 
information regarding the event be included in the Secretary's 
Morning Brief before making the phase notice determination. 7 



7 The DHS Secretary's Morning Brief is a daily compilation of material, including articles, operational 
reports, and intelligence briefings from component agencies and collaborative agencies such as the FBI and 
the Central Intelligence Agency. These materials and the related briefing are intended to allow the 
Secretary to maintain full situational awareness of events affecting national security. 
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Working Groups and Coordination Meetings Have Enhanced 
Information Sharing 

NOC management has increased involvement in working groups 
and coordination meetings. One NOC staff member said daily 
communication between NOC leadership and entities such as the 
NRCC, the NICC, and other component command centers such as 
the Transportation Security Administration's Transportation 
Security Operations Center (TSOC), and CBP's National Targeting 
Center (NTC) has increased professional relationships and fostered 
information sharing. Although not part of the NOC, the TSOC and 
the NTC work closely with NOC officials. The TSOC is the 
primary coordination point for multiple agencies that deal with 
transportation security. The NTC is the primary coordination point 
for tactical targeting and analytical research in support of CBP's 
anti-terrorism efforts. 

In addition, NOC leadership initiated the Department of Homeland 
Security Operations Centers Working Group to provide a 
departmental information sharing forum. The group was chartered 
in February 2008, and its membership includes directors and 
operations officers from 14 DHS operations centers. Appendix G 
lists the participating DHS operations centers. 

The goals of the Operations Centers Working Group are to: 

• Enhance relationships by creating a forum with established 
agency and department representation; 

• Improve information flow, mission coordination, and 
national reporting between federal operations centers in the 
areas of incident management, planning, training, and 
exercises; 

• Facilitate information sharing, situational awareness, and 
decision making; and 

• Aid issue resolution and leverage capabilities. 

The working group meets every other month, and the NOC 
Director is its Chairperson. The Operations Centers Working 
Group can establish standing committees to achieve its objectives 
and governance. Standing committees are required to report to the 
NOC Director. 
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Organizational Obstacles Continue to Challenge the National 
Operations Center 

Although NOC management has made improvements following Hurricane 
Katrina, a number of issues still hinder the effective and efficient flow of 
information. Most significantly, the NOC is negatively affected by 
organizational issues such as not having requisite authority, ambiguities in 
its mission, and an unclear chain of command. The overall focus of the 
NOC shifts between emergency management, terrorism prevention, and 
law enforcement. However, following Hurricane Katrina, the NOC began 
to dedicate most of its resources to emergency management rather than 
terrorism prevention. Many NOC staff contends that this shift in focus is 
detrimental to NOC intelligence and law enforcement functions. 

The National Operations Center Does Not Possess Requisite 
Authority and Needs More Executive-Level Support to 
Accomplish Its Mission 

Federal laws such as the Homeland Security Act of 2002 and the 
Post Katrina Emergency Management Reform Act of 2006, require 
the NOC to ensure that critical information is disseminated to key 
DHS and other government decision makers. However, no 
statutory authorities require components to forward information to 
the NOC. For example, DHS components routinely provide 
information to DHS' Secretary without first informing the NOC. 
These actions prevent the NOC from fully satisfying its 
information sharing obligations and could affect its ability to 
maintain situational awareness or a Common Operating Picture 
during a natural or manmade disaster or act of terrorism. 
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Responsibilities Are Defined in Law 



In the Homeland Security Act of 2002, Congress emphasized that 
federal, state, and local entities should share information to the 
maximum extent practicable. The act further stated that federal, 
state, and local governments and intelligence, law enforcement, 
and other emergency preparation and response agencies must act in 
partnership to maximize the benefits of information gathering and 
analysis to prevent and respond to terrorist attacks. To comply 
with the information sharing provisions of this act, in 2003 DHS 
created the Homeland Security Operations Center. Following 
Hurricane Katrina and the Post Katrina Emergency Management 
Reform Act of 2006, the Homeland Security Operations Center 
gained additional situational awareness responsibilities and was 
renamed the NOC. 9 

According to the Post Katrina Emergency Management Reform 
Act of 2006, the NOC is the principal DHS operations center and 
provides situational awareness for the federal government and for 
state, local, and tribal governments as appropriate, during a natural 
or manmade disaster or act of terrorism. The Post Katrina 
Emergency Management Reform Act of 2006 also requires the 
NOC to ensure that critical terrorism and disaster-related 
information reaches government decision makers. In accordance 
with the National Response Framework, the NOC serves as the 
national fusion center, collecting and synthesizing all-source 
information, including information from state fusion centers, 
across all threats and all hazards. 10 

The National Operations Center Has No Stated Authority to Direct 
DHS Component Participation 

Although the NOC combines the subject matter expertise of the 
law enforcement, emergency management, and intelligence 
communities, it was not designed to possess operational 
capabilities. One NOC official said the center is operational only 
in name, and does not have the capabilities or authority to direct 
DHS component resources or personnel. He added that the NOC is 



S 6U.S.C. §481. 
9 6U.S.C. § 32 Id. 

10 Approved in January 2008, the National Response Framework is a guide that presents the key response 
principles, participants, roles, and structures that guide the Nation's response operations. It describes 
specific authorities and best practices for managing incidents that range from the serious but purely local, to 
large-scale terrorist attacks or catastrophic natural disasters requiring federal assistance. It was written for 
the use of government executives, private sector and nongovernmental organization leaders, and emergency 
management practitioners. 
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responsible for coordination and must politely request information 
from DHS components. Another NOC official stated that other 
DHS operation centers such as the NRCC, the TSOC, and the NTC 
are "charting their own course" and rely very little on the NOC 
because they possess operational capabilities. Another NOC 
official said that government officials rely more heavily on entities 
external to DHS, such as the Office of the Director of National 
Intelligence's National Counterterrorism Center and the FBI's 
National Joint Terrorism Task Force, for information and 
intelligence, because they are operational in nature. The National 
Counterterrorism Center is the primary organization for integrating 
and analyzing all intelligence pertaining to terrorism possessed or 
acquired by the U.S. government. The National Joint Terrorism 
Task Force is a command center representing nearly 30 agencies 
that collects terrorism information and intelligence from local or 
regional task forces and coordinates interagency efforts at 
combating terrorism. 

Resources Were Focused on Emergency Management 
Following Hurricane Katrina 

Following Hurricane Katrina, the NOC's main mission focus 
shifted to emergency management, although personnel are tasked 
with maintaining all-hazards response readiness. NOC managers 
assert that the center is doing an excellent job focusing on "all 
threats." However, the focus on emergency management and 
disaster assistance has resulted in a greater separation between the 
Intelligence and Operations sides of the NOC. One NOC desk 
officer told us that after Hurricane Katrina, everything turned to 
disaster assistance and recovery, and described this change as a 
"pendulum swing effect." 

Some NOC desk officers said the focus on emergency management 
has negatively affected the NOC's ability to respond to multiple 
concurrent events. Originally, the NOC's predecessor, the 
Homeland Security Operations Center, was designed to respond to 
three simultaneous events. After Hurricane Katrina, some NOC 
personnel said the center has "become an arm of the Federal 
Emergency Management Agency," and they contend that the change 
has diminished the ability of all NOC personnel to respond to 
terrorist threats. Multiple NOC desk officers expressed concern 
regarding the NOC's ability to respond to a scenario involving both 
a natural disaster and a terrorist incident. Although these desk 
officers told us the NOC would likely be able to respond to both 
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events, they are concerned that NOC resources would be strained 
and that information sharing abilities would be affected. 

Additional Review Levels May Slow Information Flow 

The restructuring of OPS and the NOC, which began in 2008, 
created additional levels of review and reporting that may slow the 
flow of information to senior leadership. According to internal 
documents, NOC personnel must vet information through multiple 
levels of management before sharing it with the DHS Secretary or 
other key officials. Desk officers reported that new vetting 
requirements are more cumbersome than the old process in which 
SWOs spoke directly with the Secretary regarding emerging 
events. An internal document titled Standing Order #4, dated May 
20, 2008, describes the current reporting requirements. SWO and 
ASWO detailees receive this document as part of their orientation. 
Standing Order #4 provides a comprehensive list of tasks that 
should be considered when a threat, hazard, incident, or event is 
reported to the NOC. After making a phase determination, the 
SWO must notify as many as four levels of management before 
notifying the Secretary. 



Before the restructuring, the SWO had greater authority to report 
information directly to the DHS Secretary, and some view the 
current notification and reporting practices as more cumbersome. 
One SWO said he spoke directly to the Secretary on a regular basis 
before the restructuring. Additional levels of review and reporting 
tend to act as a "stick and rudder" steering operations at the NOC. 
Another SWO remarked, "The delay in getting timely information 
to the Secretary would likely be double what it was during Katrina." 

Situational Awareness Efforts Are Influenced by Media 
Coverage 

An overwhelming concern expressed by most of the NOC 
personnel we spoke with is the effect of the media on day-to-day 
operations. They call this the "CNN Effect." NOC management 
expects its personnel to provide vetted, accurate information 
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concerning emerging threats, hazards, incidents, or events. 
However, information requests from some senior department 
officials are frequently driven by major media news sources. 
These information requests are problematic because initial reports 
by media sources are often not as accurate as needed for the 
NOC's vetting and reporting requirements. Unlike the media, 
NOC desk officers cannot amend their reports easily, and getting 
accurate firsthand accounts from first responders is often difficult 
given the emergent and high-pressure nature of emergency 
response duties and activities. The CNN Effect causes a great deal 
of frustration for NOC desk officers and senior managers. 

Recommendations 

We recommend that the DHS Deputy Secretary: 

Recommendation #1 : Engage senior Department of Homeland 
Security headquarters and component officials to explore options 
for improving the timeliness of component and operation center 
reporting to the National Operations Center. 

We recommend that the Director of the Office of Operations 
Coordination and Planning: 

Recommendation #2 : Ensure that the National Operations 
Center's mission focus, as the National Fusion Center, emphasizes 
all-hazard response readiness, and that its mandate to provide 
situational awareness for the federal government and for state, 
local, and tribal governments as appropriate, during a natural or 
manmade disaster or act of terrorism, is clearly articulated. 

Recommendation #3 : Convene a multiple-component working 
group, with Senior Watch Officer participation, to evaluate 
whether the current review and reporting flow of information is the 
most efficient and effective way of delivering potential threats to 
senior department leadership. 

Management Comments and OIG Analysis 

We evaluated OPS' written comments and have made changes to 
the report where we deemed appropriate. A summary of OPS' 
written response to the report's recommendations and our analysis 
of the response follows each recommendation. A copy of OPS' 
response, in its entirety, is included as Appendix B. 
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OPS Response: OPS concurred with Recommendation 1 . In its 
response, OPS management said the NOC serves as the National 
Fusion Center, and federal departments and agencies "should 
report information regarding actual or potential incidents requiring 
a coordinated Federal response to the NOC." For events falling 
outside of the National Response Framework, DHS Directive 252- 
06 and DHS Instruction 252-06-001 establish DHS' operational 
reporting requirements. OPS management stated that the directive 
and instruction do not apply to all components; however, the 
instruction includes time and frequency of reporting requirements. 
OPS management recently conducted an initial assessment of 
component reporting, and will soon brief the Component 
Operations Deputies on the results of the assessment. OPS 
management plans to revise the reporting instruction and will work 
to address component and operation center directives that conflict 
with DHS reporting instructions. 

OIG Analysis: We consider OPS' proposed actions responsive to 
the recommendation, which is resolved and open. This 
recommendation will remain open pending our receipt of the 
revised reporting instruction. 

OPS Response: OPS concurred with recommendation 2. In its 
response OPS management said federal law has already established 
the NOC's mission as described in the recommendation. As stated 
in the Homeland Security Act of 2002, the "NOC is the principal 
operations center for DHS, and it shall provide situational 
awareness and a common operating picture for the entire Federal 
government, and for State, local, and tribal governments as 
appropriate, in the event of a natural disaster, act of terrorism, or 
other man-made disaster." The National Response Framework 
identifies the NOC as the National Fusion Center, and in this 
capacity the NOC fulfills its mission by fusing information from 
state fusion centers and law enforcement, intelligence, emergency 
response, open source, and private sectors. The NOC disseminates 
this information to its homeland security partners. 

With respect to meeting the needs of these homeland security 
partners, the NOC also fulfills its mission in the following ways: 
providing broad, 24/7 all-threats, all-hazards situational awareness; 
remaining vigilant in its monitoring and tracking of activities that 
may threaten the homeland; and focusing on emerging and 
ongoing events to prevent, protect, respond to, and recover from "a 
natural disaster, act of terrorism, or other manmade disaster." For 
example, during hurricane and wildfire seasons the NOC maintains 
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a heightened awareness posture regarding these potential disasters, 
while still monitoring events across the country and abroad. OPS 
agrees that the NOC's current mission focus should emphasize all- 
threats and all-hazards response readiness, and OPS will continue 
to staff the NOC with federal, state, and local partners who 
concentrate on prevention, protection, response, and recovery. 

OIG Analysis: We consider OPS' proposed actions unresponsive 
to the recommendation, which is unresolved and open. OPS did 
not address the change in mission focus as outlined in our report. 
Mission focus is a distinct concept from the formal legislated 
mission as established through the Homeland Security Act of 2002. 
Although federal law establishes the NOC's mission, there has 
been a noticeable shift in mission focus 

. Multiple desk officers said this shift 
has affected the NOC's ability to respond 

. Although maintaining heightened awareness 
is significant, it does not 

demonstrate the NOC's ability 

Rather, this demonstrates a heightened awareness 

. To be responsive and to resolve this recommendation, 
OPS needs to provide internal policy and planning documents 
demonstrating that the NOC is prepared for concurrent events 

OPS Response: OPS concurred with Recommendation 3. In its 
response, OPS management said multiple-component operations 
center working groups currently exist, and one function of these 
groups is to review information reporting flows. The Director of 
the Operations Coordination Division chartered and hosts a bi- 
monthly National Capital Region Interagency Operations Center 
Working Group meeting and a DHS Component Operations Center 
Working Group meeting. Started in 2008 and 2007 respectively, 
these working groups discuss and vet operational issues, to include 
information reporting processes. Directors of the various 
operations centers attend these meetings on behalf of their 
respective centers, and OPS will encourage NOC Senior Watch 
Officers (SWOs) to attend. For any known events, such as 
National Special Security Events, terrorist threat exercises, 
hurricanes, wildfires, etc., the working groups spend a great deal 
of time evaluating and tailoring the flow of information prior to the 
events. 

OIG Analysis: We consider OPS' proposed actions responsive to 
the recommendation, which is resolved and open. This 
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recommendation will remain open pending our receipt of 
documentation related to working group meetings in which 
information sharing is the focus. These meetings should also 
include Senior Watch Officer participation. 



Information Sharing Is Hindered by Administrative Challenges 

Although some progress and improvements have been made, NOC 
information sharing is hindered by a number of administrative concerns. 
For example, difficulty obtaining higher-level security clearances 
complicates interaction between the NOC's Operations Side and 
Intelligence Side personnel. This complication is more evident for law 
enforcement detailees assigned to the NOC. The NOC does not require 
formal agreements with DHS component detailees. Executing these 
agreements, improving desk officer training, and creating formalized 
standard operating procedures would help define detailee roles and 
responsibilities better, while also improving information sharing. The 
realism of daily training exercises for NOC personnel should be enhanced 
to provide more meaningful opportunities for the exchange of information 
and to practice roles and responsibilities. 

Relationships Between the Operations and Intelligence Sides 
Are Strained 

Despite the need for Operations Side and Intelligence Side 
personnel to work in tandem to achieve all-hazards NOC readiness, 
a disconnect exists because of an unclear chain of command and 
the inability of the Operations Side to obtain higher-level security 
clearances. At times, we observed tense relationships between the 
two sides, which negatively affect information sharing. NOC 
managers need to enhance efforts to assimilate both sides into one 
cohesive and effective unit, with a common goal to provide 
situational awareness in the event of a disaster or act of terrorism. 

There is also a need for more clarity regarding the chain of 
command when sharing information at the NOC. The Intelligence 
Side and the Operations Side have separate chains of command. 
Intelligence Side personnel report to the Under Secretary for I&A, 
while Operations Side personnel report to the Director of OPS. 

An I&A employee on the Intelligence 
Side said that he is not 100% sure of the SWO and AS WO roles 
and responsibilities. 
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Another desk officer 
remarked, "The SWOs can get better information from CNN 

As stated earlier, the SWOs manage and supervise the activities of 
the NOC and are responsible for maintaining awareness of all 
intelligence and operations being managed by DHS and NOC 
components. The SWOs are also responsible for briefing DHS 
senior leadership regarding potential or actual incidents, both 
domestic and international that may affect national security. 

We determined that some SWOs were not receiving the necessary 
information to brief DHS senior leadership on emerging issues. 
One desk officer stated that I&A has taken over control of the 
Intelligence Side of the NOC. Not everything the SWOs need to 
receive is being passed through the correct channels. A desk 
officer added that the working relationship with the Operations 
Side has further diminished in recent months. Another desk officer 
said the Intelligence and Operations sides play in different worlds, 
and 90% of what I&A knows, the SWOs do not know. 

Inability to Obtain Higher-Level Security Clearances Also Divides 
the National Operations Center 

Another factor that affects information sharing is the difference in 
security clearance levels between the NOC's Intelligence Side and 
Operations Side personnel. NOC management acknowledges past 
inefficiencies and has taken positive actions to address some 
problems related to clearance levels. Despite these improvements, 
issues regarding security clearance level still exist. Getting all 
NOC personnel cleared to a higher level would enable greater 
interaction with I&A personnel. 

Personnel on the Intelligence Side have 

while many personnel on the Operations Side have 
only the This creates 

classification and physical barriers. For example, the Intelligence 
Side operates independently and is separate from the rest of the 
facility, and most Operations Side personnel are not permitted to 
enter the Intelligence Side. Although progress has been made in 
obtaining the highest practical security clearance level for NOC 
personnel, NOC leadership should further emphasize sharing 
sanitized intelligence information in an unclassified format to 
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benefit law enforcement and emergency management and response 
efforts. 

Divisions Also Exist Between Intelligence and Law Enforcement 

The relationship between law enforcement and intelligence desk 
officers is also somewhat divided. Intelligence Side personnel 
voiced concern that law enforcement officers are not familiar with 
the proper procedures for handling classified information. Law 
enforcement officers need training to understand what is required 
of them and what information they can release. Law enforcement 
and intelligence desk officers indicated that they would benefit 
from training in the other's area of expertise. Both stated that, at a 
minimum, an overview of each side's missions, duties, and 
responsibilities would enable them to leverage their strengths 
better. 

If Intelligence Side personnel and law enforcement desk officers 
interacted more frequently, intelligence analysts would understand 
what information is beneficial to local law enforcement on the 
Operations Side. Although tear line reporting is useful, better 
professional and personal relationships and collaboration between 
the two sides could elevate the quality and usefulness of the 
information they share. 11 Cross training would enable personnel to 
see the differences in duties and responsibilities, gain a better 
working knowledge of the others' capabilities, and help foster 
professional and personal relationships, which are integral to 
information sharing. 

Some NOC personnel describe state and local law enforcement 
participation as "a coalition of the willing." Officers are detailed 
to the NOC and can return to their original organization with little 
notice, as resources within individual law enforcement agencies 
determine NOC staffing levels. NOC officials said that they are 
hesitant to expend funds to obtain higher-level security clearances 
for desk officers who are detailed for an indeterminate period. The 
NOC needs longer commitments from individual departments and 
their detailees before investing the resources to obtain higher-level 
security clearances. With a commitment from law enforcement 
desk officers for extended service periods, NOC officials would be 
more likely 



11 A "tear line" is a demarcation on an intelligence report below which the unclassified version of a more 
highly classified and controlled report begins. This permits dissemination of essential information to wider 
audiences as it no longer contains sensitive sources and methods. 
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Recommendations 



We recommend that the Director of the Office of Operations 
Coordination and Planning: 

Recommendation #4 : Clearly define the chain of command for 
all personnel at the National Operations Center and clarify that 
personnel working in the National Operations Center report 
through the Senior Watch Officer on all issues affecting 
Department of Homeland Security operations and the Secretary's 
situational awareness. 

Recommendation #5 : Establish procedures and develop guidance 
to share classified information with the Operations Side in an 
unclassified format, including revised documents and tear lines 
when necessary. 

Recommendation #6: Clear personnel 

to facilitate information sharing between 
Intelligence and Operations Side personnel. 

Recommendation #7 : Cross train law enforcement officers and 
intelligence desk officers assigned to the National Operations 
Center on one another's duties and responsibilities to gain a better 
understanding of each area of expertise. 

Management Comments and OIG Analysis 

OPS Response: OPS concurred with Recommendation 4. In its 
response, OPS management said the current NOC policy is that 
desk officers provide operationally relevant information to the 
SWO. Desk officers may also provide this information to their 
parent organization(s). The current NOC chain is articulated in the 
NOC Desk Officer Guide. OPS management said they will review 
the chain of command with all NOC officers and provide the us 
with a copy of the NOC Desk Officer Guide. 

In addition to the information provided in the guide, each NOC 
watch shift performs an internal drill in which desk officers 
practice the steps they take when responding to real-world 
incidents. Successful completion of these drills requires execution 
of the chain of command. OPS management said that in 2008, the 
NOC conducted drills for scenarios and has conducted 
drills for scenarios in 2009. OPS management added that they will 
provide copies of the scenarios to us. 
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OIG Analysis: We consider OPS' proposed actions responsive to 
the recommendation, which is resolved and open. This 
recommendation will remain open pending our receipt of the NOC 
Desk Officer Guide, which articulates the current NOC chain of 
command and documentation of the watch shift drills in which 
desk officers practice the steps taken when responding to real- 
world incidents. 

OPS Response: OPS concurred with Recommendation 5. In its 
response, OPS management said the NOC's Intelligence, Watch, 
and Warning element has standing procedures for sanitizing and 
sharing information at all classification levels. Requests for tear 
lines are processed routinely through Intelligence Community 
partners, unclassified information is disseminated via email, 
appropriately cleared information is posted to DHS portals, and 
classified briefings are open to all appropriately-cleared NOC 
personnel. Intelligence, Watch, and Warning personnel also work 
closely with DHS representatives at state and local fusion centers 
and with NOC desk officers to facilitate the sharing of intelligence 
information with federal, state, local, and tribal governments and 
private sector partners. 

OIG Analysis: We consider OPS' proposed actions responsive to 
the recommendation, which is resolved and open. This 
recommendation will remain open pending our receipt of 
Intelligence, Watch, and Warning procedures for sanitizing and 
sharing information at all classification levels and tear line 
documentation. The tear line documentation should include copies 
and the number of tear lines shared with the Operations Side of the 
NOC for FY 2009. 

OPS Response: OPS concurred with Recommendation 6. In its 
response, OPS management said all U.S. government full-time 
employees assigned to the NOC are required to possess a 
The NOC prefers that all detailees possess 

Many of the 

detailees are assigned to the NOC on rotations of six months or 
less. 



OPS management said that the recently-created OPS Detailee 
Affairs Program is drafting MOUs with component and 
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interagency partners to establish standard operating procedures. 
The MOUs will stipulate longer time commitments from 
interagency partners. With respect to personnel detailed from the 





OPS will require t 


their employees for 





per DHS policy. 

OIG Analysis: We consider OPS' proposed actions responsive to 
the recommendation, which is resolved and open. The 
recommendation will remain open pending our receipt of MOUs 
with the component and interagency partners. These MOUs 
should require longer commitments from interagency partners and 
that federal agencies sponsor their employees for 



OPS Response: OPS concurred with Recommendation 7. In its 
response, OPS management said the NOC provides training to 
operations desk officers so they better understand how to request 
and use intelligence products. The NOC also provides training to 
intelligence analysts so they better understand the level of support 
needed by various operations desk officers. NOC management 
stated they have co-located full-time NOC personnel with law 
enforcement backgrounds with intelligence personnel to expedite 
the learning process. 

OIG Analysis: We consider OPS's proposed actions responsive 
to the recommendation, which is resolved and open. This 
recommendation will remain open until our receipt of materials 
used to train operations desk officers on how to request and use 
intelligence products, and intelligence analysts training materials 
on the level of support various operations desk officers need. 

Formal Agreements With Participating Components and 
Agencies Are Needed 

Formal agreements are needed with all agencies that detail 
personnel to the NOC. Formal commitments ensure that detailed 
personnel clearly understand their roles and responsibilities, and 
they are less likely to return to their original organization with little 
prior notice. Currently, only one Memorandum of Agreement 
(MOA) exists, with the Department of Defense for the National 
Geospatial-Intelligence Agency desk officer. The NOC needs to 
institute formal MO As with all participating DHS components and 
external agencies. 
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The MO As should define, at a minimum, the duration and 
commitment of the detail, the duties and responsibilities, and the 
professional or subject matter expertise of the detailees. DHS 
headquarters should initiate these formal agreements and have each 
agency participating in NOC operations or detailing personnel to 
the NOC sign an agency-specific agreement. Executing MO As 
will ensure that expectations are fully met and adequately 
communicated to component organizations. The agreements will 
also provide NOC officials with the necessary level of 
commitment to expend resources to obtain higher-level security 
clearances. 

Recommendations 

We recommend that the Director of the Office of Operations 
Coordination and Planning: 

Recommendation #8 : Establish formal Memoranda of 
Agreement with Department of Homeland Security components 
and organizations providing desk officers to the National 
Operations Center. The agreements should define, at a minimum, 
the duration of the detail, required clearance level, duties and 
responsibilities, and the required area and level of expertise. 

Management Comments and OIG Analysis 

OPS Response: OPS concurred with Recommendation 8. In its 
response, OPS management said they recently created a Detailee 
Affairs Program that will establish and coordinate MO As with 
components and organizations. These MO As will define the 
duration of the details, the required clearance levels, generic duties, 
and management responsibilities. 

OIG Analysis: We consider OPS's proposed actions responsive 
to the recommendation, which is resolved and open. This 
recommendation will remain open pending our receipt of the 
Detailee Affairs Program position descriptions, evidence that the 
positions have been filled, and copies of MO As. 

Desk Officer Training Needs Improvement 

NOC managers said they had implemented an effective training 
program for the NOC SWO and ASWO reorganization. SWO and 
ASWO detailees received training that included classroom 
instruction, shadowing existing SWOs and ASWOs, and written 
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and oral examinations. They also received comprehensive study 
materials and an informative training handbook. However, these 
materials were not available to desk officers previously detailed to 
the NOC. Many desk officers interviewed said that an effective 
training program would help them understand their responsibilities 
and optimize their ability to achieve desired goals. 

NOC managers contend that training opportunities provided to new 
employees are adequate, although they acknowledge that there is 
room for improvement. In direct contrast to statements of NOC 
management, several desk officers reported that they received no 
formal training when they began their NOC detail. These officers 
told us there was no guidance describing day-to-day 
responsibilities, and all training occurred on the job. One detailed 
desk officer said there was a general orientation to DHS 
headquarters and the Nebraska Avenue Complex. However, this 
did little to prepare him for duty at the NOC. The training focused 
on proximity to eating establishments, parking, and facility layout. 
This desk officer described his indoctrination to the NOC as a 
"trial by fire." 

NOC desk officers said that new desk officers relied heavily on 
other NOC personnel to train them. Some desk officers obtained 
individually created handbooks left by their predecessors that 
explained duties and responsibilities. Standard instructions would 
help ensure that new desk officers are aware of all aspects of their 
jobs. 

The reliance on other NOC personnel and predecessors is 
problematic because detailees may be unwilling to ask questions 
when they need assistance or information. Desk officers need to 
be trained not only on their own duties and responsibilities, but 
also on the duties and responsibilities of all other NOC personnel. 
One desk officer said the NOC would benefit greatly by instituting 
an intensive training course on duties and responsibilities. He said 
that the NOC should also train detailees in the duties and 
responsibilities of other desks. Cross training would allow 
individual desk officers to understand the duties and 
responsibilities of their counterparts from other components better. 

In addition to developing and implementing training for desk 
officers, NOC officials need to create an employee handbook that 
provides useful information to incoming detailees. An employee 
handbook would provide a quick reference tool to help 
inexperienced desk officers gain information on multiple subjects. 
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This handbook should familiarize desk officers with general 
operations, desk officer duties and responsibilities, computer 
systems, accessibility of programs, and proper classification 
procedures. 

Some Desk Officers Are Not Prepared to Handle National 
Operations Center Duties 



Recommendations 

We recommend that the Director of the Office of Operations 
Coordination and Planning: 

Recommendation #9 : Develop an orientation and training 
program for new desk officers on the duties and responsibilities of 
all National Operations Center desks. This program should include 
the development and distribution of a handbook that familiarizes 
personnel with general operations, desk officer duties and 
responsibilities, computer systems, accessibility of programs, and 
proper classification procedures. 

Management Comments and OIG Analysis 

OPS Response: OPS concurred with Recommendation 9. In its 
response, OPS management said the NOC staff has published a 
NOC Desk Officer Guide that includes information on general 
NOC operations, computer systems, available programs, and 
classification procedures. The NOC Desk Officer Guide continues 
to be updated. The staff is currently documenting the duties and 
responsibilities of each desk officer and will add the results to the 
NOC Desk Officer Guide. Additionally, the NOC has hired a 
training officer to focus on individual and collective training needs 
and issues. 
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OIG Analysis: We consider OPS' proposed actions responsive to 
the recommendation, which is resolved and open. This 
recommendation will remain open pending evidence that the 
training officer position has been filled, our receipt of detailed 
training plans for new desk officers, and a copy of the updated 
NOC Desk Officer Guide. 

National Operations Center Standard Operating Procedures 
Are Needed 

Although some NOC desk officers have developed standard 
operating procedures on an ad hoc basis, OPS has not established 
comprehensive operating procedures or guidance to define NOC 
roles and responsibilities. NOC management has noted the need 
for operating instructions and standing orders to help maintain 
consistency and accountability. However, NOC management was 
unable to produce formalized standard operating procedures when 
requested. Instead, during our fieldwork we collected operating 
procedures from individual desk officers, many of which were 
outdated or drafted by individual detailees. 

NOC managers said they have not been able to establish formal 
standard operating procedures for each desk because the mission 
constantly changes. Not having standard procedures is most 
problematic for law enforcement desks because the frequent 
turnover of assigned personnel creates a need for continuity. 
Although law enforcement officers have created informal 
procedures, all desk officers told us that headquarters-driven 
standard operating procedures would benefit overall NOC 
operations. Standard procedures would provide continuity for 
incoming detailees. 

Recommendations 

We recommend that the Director of the Office of Operations 
Coordination and Planning: 

Recommendation #10 : Create comprehensive standard operating 
procedures that define the duties and responsibilities of each desk 
at the National Operations Center and guide personnel on proper 
actions and procedures. 
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Management Comments and OIG Analysis 

OPS Response: OPS concurred with Recommendation 10. In its 
response, OPS management said the NOC has a series of standard 
operating procedures and operating instructions in place, and the 
duties and responsibilities of the various desk officers are currently 
being added to the NOC Desk Officer Guide. 

OIG Analysis: We consider OPS' proposed actions responsive to 
the recommendation, which is resolved and open. This 
recommendation will remain open pending our receipt of the 
updated NOC Desk Officer Guide, which includes the duties and 
responsibilities specific to each desk assigned to the NOC. 

Daily Exercises Need to Be More Realistic 

NOC personnel participate in daily exercises with scenarios that 
address a variety of events involving multiple DHS components. 
While these exercises can be helpful in maintaining readiness and 
can facilitate information sharing, most NOC personnel told us the 
training scenarios are fairly basic and repetitive. Some stated that 
the exercises were at times factually inaccurate or unrealistic, 
which can be partially attributed to little input by components and 
scenario development by non-subject matter experts. A desk 
officer said, "Exercises repeat themselves and frequency is 
trumping quality and active, full participation." Other desk 
officers said the training scenarios, although helpful to new 
personnel, do little to challenge more experienced detailees. 

To add value, the frequency and effect of exercises should be 
balanced, involve more participants, and include realistic and 
factually based scenarios to simulate real-world threats, hazards, 
incidents, and events. Additionally, collaboration with 
components would provide opportunities for the exchange of 
information. NOC training personnel should use component 
detailees to create more involved and factually accurate scenarios 
to equip desk officers better to handle real-world scenarios. 
Additionally, the NOC should enhance communication and 
leverage the expertise of other component watch centers to create 
more focused, events-driven training while practicing respective 
roles and responsibilities. For instance, the NOC could leverage 
training scenarios created by the TSOC, CBP's Commissioner's 
Situation Room, and the NRCC to further train NOC personnel. 
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Recommendations 

We recommend that the Director of the Office of Operations 
Coordination and Planning: 

Recommendation #11 : Enhance communication with 
components and leverage subject matter expertise to create 
exercise scenarios that include realistic and factually based 
scenarios 



Management Comments and OIG Analysis 

OPS Response: OPS concurred with Recommendation 11. In its 
response, OPS management said the NOC has improved 
coordination with components and interagency partners prior to 
and during training events, and the NOC continues to create more 
integrated training scenarios. NOC management reiterated that 
each NOC watch shift conducts drills. SWOs and ASWOs draft 
these drills, 

They also added that they will further improve 
exercise scenarios and drills by involving component subject 
matter experts in the creation of more 

NOC management said they recently 
hired a NOC training officer to focus on training needs and issues. 

OIG Analysis: We consider OPS' proposed actions responsive to 
the recommendation, which is resolved and open. The 
recommendation will remain open pending our receipt of 
documentation that demonstrates component subject matter 
experts' involvement in exercise scenario and drill development. 



Infrastructure and Information Technology Issues Affect 
Collaboration 



improvements are necessary to enable the NOC to realize its full potential 
as DHS' principal operations center for providing situational awareness 
for federal, state, local, and tribal governments in the event of a natural or 
manmade disaster or act of terrorism. 
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Personnel Would Benefit From an Upgraded Facility or 
Build-out 

Most NOC personnel we spoke with said the current facility is 
inadequate to support the NOC's unique demands. The building 
housing the NOC cannot accommodate the number of personnel 
required to operate a watch operation of its size. NOC personnel 
said the need to update the facility is self-evident, and we agree. 

NOC management is aware that the facility is inadequate and has 
made efforts to relocate. On June 29, 2007, DHS' Undersecretary 
for Management submitted a letter to Congress requesting a 
reallocation of approximately $25 million to fund construction of a 
new NOC facility at the department's TSOC in Herndon, Virginia. 
Although congressional officials recognized the "significant 
limitations of the existing facility," Congress did not approve the 
reallocation of funds. The response to the request is in Appendix H. 



All NOC personnel we spoke with expressed the need for a 
significant build-out of current facilities or a complete relocation to 
a new or better equipped facility. Additionally, many personnel 
suggested that the NOC would benefit from being co-located with 
the TSOC or the NICC to enhance professional relationships. 
They said the existing building and infrastructure could not be 
improved sufficiently to support operations, and thought that 
having a structure near another watch center would improve 
synergy and situational awareness. 

Deficiencies Exist in Equipment and Information Technology 
Support 

We observed equipment and IT deficiencies at the NOC; 
management did not provide us with statistics on equipment 
outages and IT support requests. 

Despite assurances by managers that the situation has improved, 
most NOC personnel we spoke with indicate that issues 
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NOC Intelligence Side desk officers use multiple systems and 
monitors at each workstation to access classified and unclassified 
information. When one of the monitors or hard drives fails to 
operate, personnel use unclassified systems at one workstation to 
access unclassified systems and augment their usage with classified 
systems at another workstation. This "leapfrogging" between 
workstations has lasted for as long as three days. On a few 
occasions, analysts have gutted some computers to use parts for 
others, rather than wait for IT support. 

Many equipment issues stem from the wear and tear 

Dust and fluctuations in 
temperature affect hard drives and other equipment such as servers 
and copiers. Deficiencies are not limited to hardware, but also 
extend to software. 



I&A personnel said that system malfunctions 
sometimes complicate the sharing of necessary information with 
senior leadership during briefings. 

Although equipment issues and response times are major factors 
affecting NOC operations, a detailed analysis of related data could 
not be conducted because appropriate tracking mechanisms are not 
in place. OPS were unable to provide relevant data related to the 
frequency of equipment failures and IT support requests. Tracking 
and cataloging such data would enable NOC personnel to analyze 
problem areas, identify trends, and determine possible solutions to 
equipment issues better. 
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Recommendations 



We recommend that the Director of the Office of Operations 
Coordination and Planning: 

Recommendation #12: Provide onsite 24/7 technical support for 

Information 

and communications systems in the National Operations Center, 
and ensure the capability 

exists, so that management can address problem 
areas related to equipment failures and deficiencies in information 
technology support. 

Recomm endation # 13: Invest in computer technology to 
address deficiencies and 

issues at the National Operations Center. 

Recommendation #14 : Communicate to all personnel their ability 
to access the Homeland Security Information Network on their 
individual workstations, and formally train all personnel on its 
situational awareness and information sharing capabilities. 



Management Comments and OIG Analysis 

OPS Response: OPS concurred with Recommendation 12. In its 
response, OPS management said a process and application to 

in use by the NOC. OPS 
management added that they do not have the resources required for 
onsite 24/7 technical support. 



A report summarizing identified problems and 

associated corrective actions is provided to the Office of the Chief 
Information Officer and OPS' Chief Information Officer. 

OIG Analysis: We consider OPS' proposed actions responsive to 
the recommendation, which is resolved and open. The 
recommendation will remain open pending our receipt of OPS' 
requests for onsite 24/7 technical support to the NOC, and copies 
of the weekly reports used to summarize identified problems and 
associated corrective actions for FY 2009. 
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OPS Response: OPS concurred with Recommendation 13. In its 
response, OPS management said it contributes to a Working 
Capital Fund for the specific purpose of providing funding to the 
DHS Office of the Chief Information Officer, which is responsible 
for refreshing/replacing OPS IT equipment. Currently, the only 
NOC computers being replaced are those that stop functioning. 
The OPS Chief Information Officer is working with the DHS 
Office of the Chief Information Officer to finalize a plan for 
regular upgrades to and replacement of computer equipment in the 
NOC. In addition to 



OIG Analysis: We consider OPS' proposed actions responsive to 
the recommendation, which is resolved and open. The response to 
the recommendation will remain open pending our receipt of the 
final plan that specifies the timeline for equipment replacement. 

OPS Response: OPS concurred with Recommendation 14. In its 
response, OPS management said all operations, intelligence, 
emergency management, and law enforcement personnel in the 
NOC are trained on and have access to HSIN. Individuals are 
provided the requisite password, granted access to various 
communities of interest, and receive training on how to log on to 
and navigate HSIN. 

OIG Analysis: We consider OPS' proposed actions responsive to 
the recommendation, which is resolved and open. The 
recommendation will remain open until OPS provides us with 
documentation of a formal training plan that includes training 
requirements for HSIN. 



Staffing Inefficiencies Need to Be Addressed 

Although NOC officials have made some progress concerning staffing, 
inefficiencies that could affect information sharing remain. For example, 
some key NOC operations are dependent on contract support personnel. 
Should current contractor support be removed, the continuity of NOC 
operations and information sharing could be disrupted, as contractors have 
taken on increased duties and responsibilities. 
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Some contractors may be performing inherently governmental functions. 
For example, one contractor has program manager responsibilities and 
oversees seven NOC functions: the fusion desk, the Tracker, the 
Knowledge Management Officer, the 
representative, the Secretary's Briefing Staff, the 
chemical/biological/radiological/nuclear desk, the explosive incidents 
desk, and the state and local law enforcement desks. The contractor is 
also performing all fusion desk duties. While a review to determine 
whether NOC contractors are performing inherently governmental 
functions is outside the scope of this review, we believe the issue warrants 
further attention by our office. 



National Operations Center Reliance on Contract Support Has 
Increased 



The NOC relies heavily on contractor staff to perform its mission 
functions. Since FY 2006, the NOC's use of contractors has 
increased 195%. Sixty-two percent of the NOC's FY 2009 budget 
is designated for contract support. NOC management plans to 
spend $ 1 1 .2 million for contract support in FY 2009. By 
comparison, NOC management spent $3.8 million on contractors 
in FY 2003 (see Figures 6 and 7). 



Figure 6: NOC Contract Funding for FY 2006 to 2009 




Source: OIG Analysis of NOC contracting funding data 
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A SWO said contractors were needed in the first three years, but 
that they should have been subsequently replaced with full-time 
federal employees. The SWO also said that contractors' technical 
expertise is not as important as stated by management, and some 
contractors' jobs could be performed by a federal government 
General Schedule grade 9 or 11. Another desk officer said that 
only a few NOC employees are federal employees and that most 
are contractors, which may indicate that some contractors are 
performing inherently governmental functions. 

The NOC contracts for the Communications Watch Officer, 
Knowledge Management Officer, Fusion Desk Officer, Tracker, 
HSIN Desk Officer, Incident Management Desk Officer, and 
media monitoring desk officer positions, and for a NOC senior 
advisor. The Communications Watch Officer initiates the NOC 
conference calls, takes roll call of call participants, takes notes 
during such calls, monitors the calls for clarity, and conducts tests 
of each call list. The Incident Management Officer takes notes 
during NOC conference calls and prepares the related NOC Call 
Summary Report. 

NOC management said the reliance on contractors is due to the 
need for more experienced staff and the inability to hire staff for 
shift work. According to NOC management, there is an effort to 
replace some of the contract support with full-time government 
employees. However, no developmental plan is in place for 
federal employees. A NOC manager told us the center will 
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gradually stop using contract support once the NOC can fill the 
full-time government positions, resulting in significant overall cost 
reductions. 

Recommendations 

We recommend that the Director of the Office of Operations 
Coordination and Planning: 

Recommendation #15 : Continue efforts to replace contractors 
with full-time federal employees. 

Management Comments and OIG Analysis 

OPS Response: OPS concurred with Recommendation 15. In its 
response, OPS management said that in line with the Secretary's 
desire to reduce reliance on contractors, OPS developed a 4-year 
plan, subject to funding, to hire full-time federal employees to 
perform inherently governmental functions. 

OIG Analysis: We consider OPS' proposed actions responsive to 
the recommendation, which is resolved and open. The 
recommendation will remain open pending our receipt of the 4- 
year plan to hire full-time federal employees to perform inherently 
governmental functions. 

The National Operations Center's Reorganization Planning 
and Execution Was Deficient 

NOC management described the 2008 reorganization of the SWO 
and ASWO positions as an attempt to provide more variety in 
leadership and to help personnel deal with the high pressures and 
rigorous schedule associated with watch operation positions. The 
reorganization was also an effort to bring in the additional 
expertise of component watch officers. However, the 
reorganization has had an adverse effect on information sharing. 
Intelligence Side personnel are more reluctant to share information 
with the NOC Watch because they do not have professional 
relationships with personnel detailed to the NOC. In addition, one 
SWO could not gain access to the Intelligence Side because he did 
not have Instead, information had to be directed 

to his attending ASWO, resulting in additional delays in decision 
making. The reorganization's transition did not have formal plans, 
and managers did not explain the changes clearly to NOC 
personnel. NOC managers should have placed more emphasis on 
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developing formal plans for the transition and on communicating 
those plans to NOC personnel. 

Reorganization Had No Formal Plans 

No formal plans or training programs were in place to facilitate the 
NOC reorganization. Although managers assured us that such 
documents and training programs were in place, our interviews, 
data requests, and analysis do not indicate that such documents or 
training programs existed. The only document supplied regarding 
the NOC reorganization was a three-page memorandum titled 
"Converting the National Operations Center Senior Watch Officers 
and Assistant Senior Watch Officer Positions to Reimbursable 
Detailee Positions." A copy of this document is in Appendix I. 

The memorandum, which was signed by DHS' Deputy Secretary, 
described how the reorganization "will allow component expertise 
to be represented at the senior level and will bring the experience 
Component personnel gained at the NOC back to their parent 
organizations." The memorandum provides a general outline of 
proposed changes, but is not a detailed, formal plan. 

Although NOC desk officers acknowledge the need to make 
assignments more sustainable, personnel stress that SWO and 
ASWO detailees need a vetted, established training program before 
taking over operations. The memorandum does not discuss 
training, and does not address who will pay the salaries of former 
SWOs and ASWOs, although it does mention that component 
detailees will be reimbursable. Other than the statement "a 
selection panel will make final selections for the position," the 
memorandum includes few details relating to the application 
process. 

There are broader implications to not having a formal plan for the 
reorganization. Detailees were assigned to the NOC without 
formal MOAs between DHS headquarters and component 
organizations. This is problematic in that detailed SWOs and 
ASWOs could be pulled back to component organizations with 
little prior notice. In addition, the memorandum dictates that the 
following components are required to nominate at least two people 
for the SWO and ASWO positions, respectively, by 
September 7, 2008: 

• CBP 

• Federal Emergency Management Agency 
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• U.S. Immigrations and Customs Enforcement 

• Transportation Security Administration 

• U.S. Citizenship and Immigration Services 

• U.S. Coast Guard 

• U.S. Secret Service 

These components provided fewer applicants than expected, and 
the deadline was extended. However, the reorganization had 
already been announced to NOC personnel, and a number of 
SWOs and ASWOs left for new positions. This situation could 
have created a significant leadership vacuum at the SWO and 
ASWO level. Formal planning documents for the reorganization 
would have provided viable contingency plans to assist NOC 
management in addressing such unforeseen staffing issues. 

Managers Were Not Transparent Regarding Proposed Changes and 
Were Unreceptive to Suggestions 

Despite efforts to communicate the reorganization to components, 
NOC managers' communications with NOC personnel were not 
transparent regarding the proposed changes to the SWO and 
ASWO positions. Although the reorganization was announced to 
NOC employees in May 2008, affected personnel were not 
provided formal guidance regarding staffing changes. A NOC 
employee told us "it was as if the hammer had dropped, and the 
floor was numb." Another SWO reported that the SWOs and 
ASWOs were told they needed to find other employment by 
October 1, 2008. Since their positions were not being eliminated 
and staff did not fall under reduction in force provisions, 
employees were not considered displaced within the department 
and were not eligible for unemployment assistance. 

The uncertainty regarding changes to the NOC resulted in anxiety 
and morale issues for all NOC employees. Although the 
department's Office of the Chief Human Capital Officer offered 
assistance to affected personnel, this assistance was slow to 
materialize. Many SWOs and ASWOs applied for jobs outside 
DHS to ensure continued employment. 

Reorganization plans should have provided a vehicle for input and 
suggestions from displaced SWOs and ASWOs. However, NOC 
management largely dismissed employee suggestions regarding 
changes. Such suggestions were often valid and would have 
resulted in a more effective reorganization. A number of NOC 
employees felt the new SWOs should be staffed from current NOC 
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desk officers. Such staffing would shorten the learning curve of 
detailed personnel and ensure that individuals possessed 
operational knowledge. SWOs and ASWOs also suggested 
keeping on some seasoned personnel to develop standard operating 
procedures and operating instructions. Finally, NOC personnel 
cautioned management about the amount of time it takes to clear 
personnel to the As a result of 

delays in the process, one of the component SWOs has 

been excluded from the NOC's Intelligence Side. Similar delays 
in the process could result in negative effects on future 

information sharing between the Intelligence and Operations sides. 

Reorganization Timing Was Problematic 

The reorganization's timing was problematic. The replacement of 
SWOs and ASWOs was scheduled during a series of important 
national events. NOC personnel felt the impending elections, 
ongoing hurricane season, planning for the presidential 
inauguration, and the resulting change of administration created a 
high-stress period and was not the appropriate time to reconstitute 
NOC leadership. These operational concerns likely resulted in the 
decision by NOC management to delay the transition past the 
original date of October 1, 2008. Nevertheless, some component 
detailees assumed responsibility for NOC operations in January 
2009, one week before the inauguration. 

Had a significant event occurred, NOC desk officers expressed 
uncertainty as to whether component detailees possessed the 
knowledge, expertise, and experience to initiate an appropriate 
response. A desk officer expressed concern because the elections 
and resulting change in administrations presented a prime 
opportunity for terrorists to strike. Another NOC employee said 
that even without the elections, the new SWOs and ASWOs would 
face a steep learning curve. Regardless of the possible effects of 
the reorganization, NOC personnel will experience another period 
of transition in two years, when all recently detailed staff complete 
their rotation and return to their parent organizations. 

Recommendations 

We recommend that the Director of the Office of Operations 
Coordination and Planning: 

Recommendation #16 : Develop formal planning documents and 
internal guidance for all future staffing changes or organizational 
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realignments, to enhance effective, timely, and accurate 
information sharing and continuity of operations. 

Management Comments and OIG Analysis 

OPS Response: OPS concurred with Recommendation 16. In its 
response, OPS management said that during the last two years, 
staffing changes and organizational realignments have reflected the 
implementation of the Mission Blueprint study conducted for OPS 
by Booz Allen Hamilton and delivered to OPS in March 2007. 
Further changes based on new requirements and additional mission 
taskings continually need to be reconciled with the organizational 
structure and capabilities that were previously outlined in the 
Mission Blueprint. OPS management added that they will develop 
a formal plan, which will establish procedures to ensure continued 
operations regardless of staffing changes. 

OIG Analysis: We consider OPS' proposed actions responsive to 
the recommendation, which is resolved and open. The 
recommendation will remain open pending our receipt of the 
formal plan that ensures continued operation when faced with 
staffing changes. 

Intelligence Side Would Benefit From Component Detailees 

The NOC's Intelligence Side would benefit from increased 
involvement of component intelligence officers in day-to-day 
operations. NOC management said the center's reorganization was 
intended to increase component involvement and leverage the 
expertise of subject matter experts to improve information sharing. 
However, DHS component detailees are largely limited to the 
Operations Side. Although the Intelligence Side is staffed with 
multiple desk officers, there is only one component detailee from 
the U.S. Secret Service. Additional Intelligence Side detailees 
could enhance component relationships, while also providing for a 
more effective exchange of information. 

Detailed intelligence officers would enable the NOC to leverage 
specific areas of expertise to fulfill its mission better. In addition, 
individual DHS components would benefit from increased 
information sharing as detailees gain valuable insight into watch 
and warning functions. At the conclusion of their detail, NOC 
desk officers will have developed key skills and abilities that 
contribute to the overall mission of their component. As a result, 
detailed intelligence officers would gain institutional knowledge 
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and professional contacts necessary to link departmental 
information gathering efforts in the field with efforts at DHS 
headquarters. 

Recommendations 

We recommend that the Director of the Office of Operations 
Coordination and Planning: 

Recommendation #17 : Augment the Intelligence Side of the 
National Operations Center with intelligence officer detailees from 
DHS components to enhance relationships and facilitate 
information sharing. 

Management Comments and OIG Analysis 

OPS Response: OPS concurred with Recommendation 17. In its 
response, OPS management said that while this recommendation is 
fully supported by OPS, it is problematic for components due to 
the limited number of component intelligence analysts. To further 
diversify the NOC's human capital resources, the OPS Director 
will formally request intelligence analysts and officers from the 
components via the DHS Under Secretary for Intelligence and 
Analysis. 

OIG Analysis: We consider OPS' proposed actions responsive to 
the recommendation, which is resolved and open. The 
recommendation will remain open pending our receipt of 
documentation that OPS has solicited the DHS Under Secretary for 
Intelligence and Analysis regarding detailing intelligence analysts 
to the NOC and the disposition of those requests. 



Conclusion 

Although OPS has made significant progress at the NOC, a number of 
areas require improvement. Organizational, administrative, infrastructure, 
IT, and staffing obstacles continue to hinder NOC information sharing and 
collaboration. Federal laws such as the Homeland Security Act of 2002 
and the Post Katrina Emergency Management Reform Act of 2006 require 
the NOC to serve as the principal DHS operations center and provide 
situational awareness for the federal government and for state, local, and 
tribal governments as appropriate. However, because the NOC does not 
possess the operational capacity or authority to require DHS components 
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and other watch centers to channel information through the NOC Watch to 
key decision makers, it is unable to meet these requirements. 

NOC information sharing is further hindered by administrative concerns, 
including disparities in security clearance levels among personnel, a need 
for formal MOAs, and an absence of official standard operating 
procedures. NOC management acknowledges inadequacies related to 
infrastructure, but has been unable to gain funding and approval for a 
sufficient build-out of the current facility or construction of a new facility. 
Furthermore, NOC officials need to address significant staffing 
inefficiencies to improve overall operations and effectiveness. OPS is 
overly reliant on contract support personnel to fill NOC positions, and 
recent staffing changes have been deficient in both planning and 
execution. 

To complete its mission successfully, the NOC needs support from key 
executive department officials and stakeholders. To this end, DHS 
leadership needs to emphasize the NOC's importance in enhancing 
information sharing efforts throughout DHS, the federal government, and 
with state and local entities and regional fusion centers. Specifically, 
components and component watch centers should be required to direct all 
relevant information to the NOC to ensure that critical terrorism, law 
enforcement, and disaster-related information reaches government 
decision makers timely and accurately. 

As DHS leadership emphasizes the NOC's importance and key 
department officials provide the requisite support to its operations, the 
NOC will be positioned better to realize its full potential as intended by 
Congress — as DHS' principal operations center, providing situational 
awareness for the federal government and for state, local, and tribal 
governments, as appropriate, in the event of a natural or manmade disaster 
or act of terrorism. 
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Appendix A 

Purpose, Scope, and Methodology 

We assessed information sharing at the NOC in response to a 
request from U.S. Representative Bennie G. Thompson, Chairman 
of the House Committee on Homeland Security. Our review 
focused on the functional and organizational changes DHS made to 
the NOC after Hurricane Katrina to manage the flow of 
information better. Our objectives were to determine whether: 

• New procedures instituted ensure that incoming reports are 
appropriately directed within the center; 

• Information is reviewed and disseminated timely to key 
department officials; and 

• Information is coordinated efficiently and effectively with 
other federal, state, and local government partners that have 
a role in response operations. 

To accomplish our objectives, we reviewed the NOC's current and 
former processes for managing the flow of information to ensure 
that incoming reports are appropriately directed within the center. 
This included reviewing all relevant NOC and OPS regulations, 
policies, and procedures, as well as interviewing NOC employees. 

We analyzed six past events during which information had been 
reviewed and disseminated to key department officials to 
determine whether the information reported was relevant, useful, 
and timely. 

To assess whether information was coordinated efficiently and 
effectively with other federal, state, and local partners, we 
examined current NOC staff composition, situational awareness 
tools used by personnel, relevant working groups, relationships 
between the NOC and mission partners, participation in training 
and joint exercises, and processes used to communicate real-time 
information to DHS leadership. 

Although our review focused on DHS headquarters personnel, we 
interviewed more than 100 NOC staff, as well as others from DHS 
components and mission partners. For comparative purposes, we 
also visited coordination and operations centers in the Washington, 
DC, metropolitan area. We visited the department's NRCC, 
Mount Weather Facility, NICC, TSOC, U.S. Coast Guard 
Command Center, CBP's Commissioner's Situation Room, NTC- 
Passenger, and NTC-Cargo. In addition, we visited other federal 
department operation centers, such as the Office of the Director of 
National Intelligence's National Counter Terrorism Center and the 
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Appendix A 

Purpose, Scope, and Methodology 

Department of Defense's National Joint Operations Intelligence 
Center. 

Our fieldwork began in June 2008 and concluded in April 2009. 
We initiated this review under the authority of the Inspector 
General Act of 1978, as amended, and according to the "Quality 
Standards for Inspections," issued by the President's Council of 
Integrity and Efficiency. 
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Management Comments to the Draft Report 



Office of Operations Coordination 
and Planning 

11,5. Department of Homeland Security 

Washington. DC 20393 




Homeland 
Security 



October 26, 2009 



MEMORANDUM FOR: 



Carlton L Mann 

Assistant Inspector General for Inspections 



FROM: 



John C. ActopjgnWy {/Inr™! 

Director, OfTjZcof Operations Coordination and Planning 




SUBJECT: 



Response to the Office of Inspector General (OIG) Report on 
"Information Sharing at the National Operations Center" 



The Office of Operations Coordination and Planning (OPS) appreciates the opportunity to 
comment on the DHS OIG Report on "Information Sharing at the National Operations Center." 
The National Operations Center (NOC) continues to make improvements in providing situational 
awareness for all threats/hazards in order to prevent, protect, respond to, and recover from a 
natural or man-made disaster or act of terrorism. The NOC also continues to be at the forefront 
of information sharing across the Department and across Federal, State, tribal, and local 
government sectors. 

The report highlights many legitimate issues regarding information sharing — some we are 
currently addressing, along with several substantial issues that still require attention. Based on 
our internal review, I offer the following updates regarding our work-in-progress for ongoing 
NOC initiatives that address the OIG Report's recommendations. 



Recommendation #1. Engage senior Department of Homeland Security headquarters and 
Component officials to explore options for improving the timeliness of Component and 
operation center reporting to the National Operations Center. 



OPS concurs with this recommendation and is continuing to work to institutionalize the 
reporting process. As stated in the National Response Framework, the NOC serves as the 
National Fusion Center, and Federal departments and agencies '"should report 
information regarding actual or potential incidents requiring a coordinated Federal 
response to the NOC." For events falling outside of the National Response Framework, 
DHS Directive # 252-06 and DHS Instruction # 252-06-001 establish the DHS 
operational reporting requirements. The directive and instruction apply to U.S. 
Citizenship and Immigration Services (USCIS), U.S. Coast Guard (USCG), U.S. 
Customs and Border Protection (CBP), Domestic Nuclear Detection Office (DNDO), 
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U.S. Immigration and Customs Enforcement (ICE), U.S. Secret Service (USSS), 
Transportation Security Administration (TSA), and U.S. Visitor and Immigrant Status 
Indicator Technology Program Office (US-VISIT); the instruction includes time and 
frequency of reporting requirements. OPS recently conducted an initial assessment of 
Component reporting, and will soon brief the Component Operations Deputies on the 
results of the assessment. OPS intends to revise the reporting instruction within the next 
three months and will work to address Component and operation center directives that 
conflict with DHS reporting instructions. 



Recommendation #2. Ensure that the National Operations Center 's mission focus, as the 
National Fusion Center, emphasizes all-hazard response readiness, and that its mandate to 
provide situational awareness for the F ederal government and for State, local, and tribal 
governments as appropriate, during a natural or manmade disaster or act of terrorism, is 
clearly articulated 



OPS concurs with this recommendation. Federal law has established the NOC's mission 
as described in the recommendation. As stated in the Homeland Security Act of 2002, 
the "NOC is the principal operations center for DHS, and it shall provide situational 
awareness and a common operating picture for the entire Federal government, and for 
State, local, and tribal governments as appropriate, in the event of a natural disaster, act 
of terrorism, or other man-made disaster." The National Response Framework identifies 
the NOC as the National Fusion Center, and in this capacity, the NOC fulfills its mission 
by fusing information from State fusion centers and law enforcement, intelligence, 
emergency response, open source, and private sectors. The NOC disseminates this 
information to its Homeland Security partners. 

With respect to meeting the needs of these Homeland Security partners, the NOC also 
fulfills its legislated mission in the following ways: providing broad, 24/7 all-threats, all- 
hazards situational awareness; remaining vigilant in its monitoring and tracking of 
activities that may threaten the Homeland; and focusing on emerging and ongoing events 
to prevent, protect, respond to, and recover from "a natural disaster, act of terrorism, or 
other man-made disaster." For example, during hurricane and wildfire seasons, the NOC 
maintains a heightened awareness posture regarding these potential disasters while still 
monitoring events across the country and abroad. OPS agrees that the NOC's current 
mission focus should emphasize all-threats and all-hazards response readiness, and OPS 
will continue to staff the NOC with Federal, State, and local partners who concentrate on 
prevention, protection, response, and recovery. 



Recommendation #3. Convene a multiple-Component working group, with senior watch 
officer participation, to evaluate whether the current review and reporting flow of 
information is the most efficient and effective way of delivering potential threats to senior 
Department leadership. 



OPS concurs with this recommendation. Multiple-Component operations center working 
groups currently exist, and one function of these groups is to review information 
reporting flows. The Director of the Operations Coordination Division chartered and 
hosts a bi-monthly National Capital Region Interagency Operations Center Working 
Group meeting and a DHS Component Operations Center Working Group meeting. 
Started in 2008 and 2007, respectively, these working groups discuss and vet operational 
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issues, to include information reporting processes. Directors of the various operations 
centers attend these meetings on behalf of their respective centers, and we will encourage 
NOC Senior Watch Officers (SWOs) to attend. For any known events — National 
Security Special Events, terrorist threat exercises, hurricanes, wildfires, etc. — the 
working groups spend a great deal of time evaluating and tailoring the flow of 
information prior to the events. 



Recommendation H4. Clearly define the chain of command for all personnel at the National 
Operations Center and clarify that personnel working in the NOC report through the Senior 
Watch Officer (SWO) on all issues affecting DHS operations and the Secretary 's situational 
awareness. 



OPS concurs with this recommendation. The current NOC policy is that desk officers 
provide operationally relevant information to the Senior Watch Officer (SWO). Desk 
officers may also provide this information to their parent organization(s). The current 
NOC chain is articulated in the NOC Desk Officer Guide though the chain is not always 
followed by all desk officers. OPS will review the chain of command with all NOC 
officers and will provide the NOC Officer Desk Guide to the Office of the Inspector 
General. 

In addition to the information provided in the Guide, each NOC watch shift performs an 
internal drill in which desk officers practice the steps they take when responding to real- 
world incidents. Successful completion of the drills requires execution of the chain of 
command. 

OPS will provide copies of these scenarios 

to the Office of the Inspector General. 



Recommendation #5. Establish procedures and develop guidance to share classified 
information with the Operations Side in an unclassified format, including revised documents 
and tear lines when necessary. 



These procedures are already in place in NOC. and therefore, OPS concurs with this 
recommendation. The NOC's Intelligence, Watch, and Warning (IWW) element has 
standing procedures for sanitizing and sharing information at all classification levels. 
Requests fortearlines are processed routinely through Intelligence Community partners, 
unclassified information is disseminated via email, appropriately cleared information is 
posted to DHS portals, and classified briefings are open to all appropriately-cleared NOC 
personnel. IWW personnel also work closely with DHS representatives at State and local 
fusion centers and with NOC desk officers to facilitate the sharing of intelligence 
information with Federal, State, local, and tribal governments and private sector partners. 



Recommendation #6. Clear personnel to the to 
facilitate the sharing of intelligence information between intelligence and operations 
personnel. 
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Recommendation #7. Cross train law enforcement officers and intelligence desk officers 
assigned to the National Operations Center on one another 's duties and responsibilities to 
gain a better understanding of each area of expertise. 



Training intended to Facilitate information sharing between NOC desk officers is already 
in place at the NOC, and therefore, OPS concurs with this recommendation. Currently, 
the NOC provides training to operations desk officers so they better understand how to 
request and use intelligence products. The NOC also provides training to intelligence 
analysts so they better understand the level of support needed by various operations desk 
officers. To expedite the learning process, we have co-located full-time NOC personnel 
with law enforcement backgrounds with intelligence personnel. This allows law 
enforcement and intelligence experts to share knowledge and facilitates immediate 
information sharing between the two communities. 



Recommendation US. Establish formal Memoranda of Agreement with Department of 
Homeland Security Components and organizations providing desk officers to the National 
Operations Center. The agreements should define, at a minimum, the duration of the detail, 
required clearance level, duties and responsibilities, and the level of expertise. 



OPS concurs with this recommendation and has recently created a Delailcc Affairs 
Program that will establish and coordinate Memorandums of Agreement (MOAs) with 
Components and organizations. These MOAs will define duration of the detail, required 
clearance level, generic duties, and management responsibilities. 



Recommendation U9. Develop an orientation and training program for new desk officers on 
the duties and responsibilities of all National Operations Center desks. This program should 
include the development and distribution of a handbook that familiarizes personnel with 
general operations, desk officer duties and responsibilities, computer systems, accessibility 
of programs, and proper classification procedures. 



OPS concurs with this recommendation. In support of" the NOC Concept of Operation 
and Standard Operating Procedures, the NOC staff published a NOC Desk Officer Guide 
that includes information on general NOC operations, computer systems, available 
programs, and classification procedures. The NOC Desk Officer Guide continues to be 
updated. The staff is currently documenting the duties and responsibilities of each desk 
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officer and will add the results to the NOC Desk. Officer Guide. Additionally, the NOC 
has lured a training officer to focus on individual and collective training needs and issues. 



Recommendation HIO. Create comprehensive standard operating procedures that define the 
duties and responsibilities of each desk at the National Operations Center and guide 
personnel on proper actions and procedures 



OPS concurs with this recommendation. As stated in the response to Recommendation 
U9, the NOC has a series of standard operating procedures and operating instructions in 
place, and the duties and responsibilities of the various desk officers are currently being 
added to the NOC Desk Officer Guide. 



Recommendation ML Enhance communication with Components and leverage subject 
matter expertise to create exercise scenarios that include realistic and factually based 
scenarios 



OPS concurs with this recommendation. The NOC has improved coordination with 
Components and interagency partners prior lo and during training events, and the NOC 
continues to create more integrated training scenarios. As mentioned in the response to 
recommendation #4, each NOC watch shift conducts drills. Senior Watch Officers 
(SWOs) and Assistant Senior Watch Officers (ASWOs) draft these drills 

As described in 

the response to recommendation #9. the NOC recently hired a NOC training officer to 
focus on training needs and issues; this training officer will facilitate Component 
involvement in exercise scenarios and drills. 



Recommendation #12. Provide onsite, 24/7 technical support for 

and communication systems in National Operations Center, and 
ensure the capability exists, so that 

management can address problem areas related to equipment failures and deficiencies in 
information technology support 



OPS concurs with this recommendation. Although a process (and application) 

in use by the NOC, the NOC does not have the 
resources required to provide onsite 24/7 technical support. The DHS Office of the Chief 
Information Officer (OCIO) provides the application currently in use, which has been in 
use by the DHS Help Desk for several years. Under the current process, an individual 
needing assistance will call the Help Desk, and a help desk officer will create a service 
ticket which then will be tracked through to completion. A weekly report summarizing 
identified problems and associated corrective actions is provided to the DHS OCTO and 
the OPS CIO. 



Recommendation U 13. Invest in computer technology to address and 
deficiencies and issues at the National Operations Center. 
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OPS concurs with this recommendation. OI'S contributes to a Working Capital Fund for 
the specific purpose of providing funding to the DHS OCIO, which is responsible for 
refreshing/replacing OPS IT equipment. Currently, the only NOC computers being 
replaced are those that stop functioning. The OPS CIO is working with the DHS OCIO 
to finalize a plan for regular upgrades to and replacement of computer equipment in the 
NOC. 



In addition to these upgrades, OPS is pursuing the development of an executive 
communications capability at the request of the DHS Secretary and Deputy Secretary. 
This requirement for executive communications includes 24/7 reliable global 
communications support across all security classification levels. 



Recommendation #14. Communicate to all personnel their ability to access the Homeland 
Security Information Network on their individual workstations, and formally train all 
personnel on its situational awareness and information sharing capabilities. 



All operations, intelligence, emergency management, and law enforcement personnel in 
the NOC arc trained on and have access to the Homeland Security Information Network 
(HSIN). Individuals are provided the requisite password, granted access to various 
communities of interest, and receive training on how to log on to and navigate HSIN. 
OPS therefore concurs with this recommendation. 



Recommendation #15. Continue efforts to replace contractors with full-time Federal 
employees. 



OPS concurs with this recommendation. In line with the Secretary's desire to reduce 
reliance on contractors, OPS developed a 4-year plan, subject to funding, to hire full-time 
Federal employees to perform inherently governmental functions. 



Recommendation #16. Develop formal planning documents and internal guidance for all 
future staffing changes or organizational realignments, to enhance effective, timely, and 
accurate information sharing and continuity of operations. 



OPS concurs with this recommendation. During the last two years, staffing changes and 
organizational realignments have reflected the implementation of the Mission Blueprint 
study conducted for OPS by Booz Allen Hamilton and delivered to OPS in March 2007. 
Further changes based on new requirements and additional mission taskings need to 
continually be reconciled with the organization and capabilities that were previously 
outlined in the Mission Blueprint. OPS will develop a formal plan within 90 days of 
submitting this response, which will establish procedures to ensure continued operations 
in the face of staffing changes. 
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Recommendation HI 7. Augment the Intelligence Side of (he National Operations Center 
with intelligence officer detailees from DHS Components to enhance relationships and 
facilitate information sharing. 

This initiative, while fully supported by OPS, is problematic for Components due to the 
limited number of Component intelligence analysts. In an effort to further diversify the 
NOC's human capital resources, the OPS Director will formally request intelligence 
analysts and officers from the Components via the DHS Under Secretary for Intelligence 
and Analysis. This request will be sent within 30 days of submitting this response. 

We are listing information from the report that should be excluded from public release under 
separate cover. 
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Appendix E 

National Operations Center Operational Phases and Director's Criteria 
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Appendix G 

DHS Operations Center Working Group Participants 

U.S. Citizenship and Immigration Services Command Center 
U.S. Coast Guard Command Center 

U.S. Computer Emergency Readiness Team Operations Center 

U.S. Customs and Border Protection Commissioner's Situation Room 

Domestic Nuclear Detection Office Joint Analysis Center 

Federal Air Marshal Service Mission Operations Center 

Federal Emergency Management Agency Operations Center 

U.S. Immigration and Customs Enforcement Operations Center 

Incident Management Cell, Contingency Planning & Incident 
Management Division - Office of Infrastructure Protection, National 
Protection and Programs Directorate 

National Coordination Center - National Communications System, 
National Protection and Programs Directorate 

National Operations Center 

Office of Health Affairs - National Bio-surveillance Integration Center 

Transportation Security Operations Center 

U.S. Secret Service Intelligence Division Duty Desk 

Source: DHS Operations Centers Working Group Charter 
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The Honorable Michael Chertoff 
Secretary 

Department of Homeland Security 
Washington, D.C. 20528 

Dear Mr. Secretary; 

This letter is in response to the Department's June 29, 2007, submission of fiscal year 2007 
reprogramming requests for the Operations Directorate. 

As discussed in the letter from Undersecretary Schneider, DHS has proposed reallocating 
$25,01 million from a variety of agencies to the DHS Chief Administrative Officer in order to 
fund construction of a new National Operations Center (NOC) facility at the Transportation 
Security Operations Center (TSOC) building in Hemdon, Virginia. While I recognize the 
significant limitations of the existing NOC facility, I do not approve the reallocation and 
expenditure of these funds at this time for the following reasons: 

1. I am concerned that full cost estimates for this project have not been submitted to the 
Committees. For example, my staff only recently learned that the Secretary's situation 
room project, which will be located in the current NOC space, is estimated to cost over 
$6,000,000, and funding has not been specifically appropriated or requested for this 
purpose. 

2. No alternative funding sources have been identified in lieu of the proposed $8.7 million 
reallocation from Coast Guard maintenance, 

3. The Department has not yet accounted for the expenditure of S30 million provided by 
Congress in fiscal years 2004 and 2005 for construction of the current NOC. I 
understand that the Department is now attempting to fully account for this funding, and i 
look forward to receiving this analysis in the near future. 

4. The Department has indicated that it is contractually bound to use the construction 
services of the TSOC building owner to make any modifications to the facility. Because 
the original construction of the TSOC included several questionable activities, I believe it 
is critical for the Department to negotiate an amendment to the TSOC contract to permit 
an open competition for new TSOC construction activities. 
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For these reasons, I cannot approve the reprog ramming request at this time. I will be 
happy to consider a revised proposal that addresses these concerns, and encourage your 
financial managers to work closely with the Committee staff to resolve these issues. 




David Price 
Chairman, 
Subcommittee on Homeland Security 
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Deputy Secretary 
U.S. DcpaitmimoFHi 
Washington, DC 20528 



d Security 




k Homeland 
w Security 



FROM: 



MEMORANDUM FOR: 



Distribution List 



Deputy Secretary Schneider 




SUBJECT: 



Converting the National Operations Center Senior Watch Officers 
and Assistant Senior Watch Officer Positions to Reimbursable 
Detailee Positions 



The National Operations Center (NOC) is staffed by permanent Senior Watch Officers (SWOs) 
and Assistant Senior Watch Officers (ASWOs). The NOC, and the Department as a whole, will 
be best served if these positions are filled by rotational personnel from our Components on a 
reimbursable basis. This change will allow Component expertise to be represented at the senior 
level and will bring the experience Component personnel gained at the NOC back to their parent 
organizations. In addition, we expect that making the SWO and ASWO positions rotational will 
make these demanding assignments more sustainable. Our goal is to phase in new personnel 
around October 1, 2008. 

To replace these permanent positions with rotational personnel, Component detailees need to be 
identified, and the current SWO and ASWO cadre need to be reassigned into new positions. 
I request your assistance with both aspects of this change. 

Detailees for SWO and ASWO Position.: 

There are 10 SWO and 10 ASWO positions which will need to be filled by detailees. These 
detail assignments will be reimbursable and will last for a period of two years. Attached are the 
position descriptions for the SWO and ASWO positions. While the SWO position is classified 
as a GS-15 and the ASWO is classified as a OS- 14, high performing GS-14s and GS-I3s will be 
considered for these positions as well. 

The following Components are required to nominate at least two people for the SWO and two 
people for ASWO positions; 

• U.S. Customs and Bo rder Protect! on 

• Federal Emergency Management Agency 

• U.S. Immigration and Customs Enforcement 

• Transportation Security Administration 

• U.S. Citizenship andlmmigrationServices 

• U.S. Coast Guard 

• U.S. Secret Service 



www. 
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All other Components are highly encouraged to nominate personnel as well, but they are not 
required to do so. All qualified nominees will be interviewed, and a selection panel will make 
final selections for the positions. The Office of Operations Coordination and Planning (OPS) 
will provide all necessary training to the successful candidates. 

Please provide nominations for SWO and ASWO detail assignments to the point of contact listed 
below by September 7, 2008. 



Positions for Existing SWOs and ASWOs : 

I am also asking for your assistance in finding new positions for current GS-15 level SWOs and 
GS-14 level ASWOs to which they will be moved through direct reassignments. The individuals 
currently filling these slots have a unique professional background and will bring a wealth of 
knowledge to their new positions. Due to the nature of their current work, they have a deep 
understanding of the variety of operations performed throughout DHS and have been required to 
interpret DHS policies in support of these operations. These employees are skilled at handling 
executive-level information requests and in framing responses to such requests. They have broad 
experience in understanding DHS interactions with the Federal interagency at the highest levels, 
as well as high-level State and local officials. Most SWOs and ASWOs came to DHS from other 
Federal entities, such as the U.S. Department of State and the U.S. Department of Defense. 

The goal is to find a good fit for these employees within DHS's Components, while at the same 
time helping your Components fill vacancies with talented individuals. These individuals are 
available for reassignment starting almost immediately, 

Please provide information about current openings or prospective future openings that you think 
may be appropriate for these employees to my point of contact below by September 7, 2008. As 
new positions become available in your respective Components, please keep us informed. OPS 
will work with the Chief Human Capital Office to circulate these opportunities among the SWO 
and ASWO cadre and take follow-up actions, 

I appreciate your assistance, and believe that these changes will result in a net gain for the NOC, 
your Components, and the Department overall. Please provide all requested information 
including your nominations for the SWO or ASWO positions and job openings to Ruby Miller, 
Chief, Administration and Logistics Division, OPS, at (202) 282-0973 or ruby.l.miller@dhs.gov. 

Distribution : 

Citizenship and Immigration Services Ombudsman 
Director, U.S. Citizenship and Immigration Services 
Director, Office of Civil Rights and Civil Liberties 
Commandant, U.S. Coast Guard 
Commissioner, U.S. Customs and Border Protection 
Director, Domestic Nuclear Detection Office 
Director, Counternarcotics Enforcement 



www.dhs.gov 2 
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Administrator, Federal Emergency Management Agency 
Director, Federal Law Enforcement Training Center 
Assistant Secretary, Office of Health Affairs 
Assistant Secretary, U.S. Immigration and Customs Enforcement 
Inspector General 

Assistant Secretary, Office of Legislative Affairs 

Under Secretary, Office of Intelligence and Analysis 

Under Secretary, Management Directorate 

Chief Financial Officer, Management Directorate 

Under Secretary, National Protection and Programs Directorate 

Assistant Secretary, Office of Policy 

Chief Privacy Officer 

Assistant Secretary, Office of Public Affairs 
Director, U.S. Secret Service 

Assistant Secretary, Transportation Security Administration 



ir.dha.gov 
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Major Contributors to this Report 



Marcia Moxey Hodges, Chief Inspector, Department of Homeland 
Security, Office of Inspector General, Office of Inspections 

Angela Garvin, Senior Inspector, Department of Homeland 
Security, Office of Inspector General, Office of Inspections 

McKay Smith, Inspector, Department of Homeland Security, 
Office of Inspector General, Office of Inspections 
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Report Distribution 



Department of Homeland Security 

Secretary 

Deputy Secretary 

Chief of Staff for Operations 

Chief of Staff for Policy 

Deputy Chiefs of Staff 

General Counsel 

Executive Secretariat 

Assistant Secretary for Office of Policy 

Assistant Secretary for Office of Public Affairs 

Assistant Secretary for Office of Legislative Affairs 

Under Secretary for Office of Intelligence and Analysis 

Director for Office of Operations Coordination and Planning 

Director, GAO/OIG Liaison Office 

Operations Coordination Audit Liaison 

Office of Management and Budget 

Chief, Homeland Security Branch 
DHS OIG Budget Examiner 

Congress 

Congressional Oversight and Appropriations Committees, as 
appropriate 
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ADDITIONAL INFORMATION AND COPIES 

To obtain additional copies of this report, please call the Office of Inspector General (OIG) at (202) 254-4100, 
fax your request to (202) 254-4305, or visit the OIG web site at www.dhs.gov/oig. 



OIG HOTLINE 

To report alleged fraud, waste, abuse or mismanagement, or any other kind of criminal or noncriminal 
misconduct relative to department programs or operations: 

• Call our Hotline at 1-800-323-8603; 

• Fax the complaint directly to us at (202) 254-4292; 

• Email us at DHSOIGHOTLINE@dhs.gov; or 

• Write to us at: 

DHS Office of Inspector General/MAIL STOP 2600, 
Attention: Office of Investigations - Hotline, 
245 Murray Drive, SW, Building 410, 
Washington, DC 20528. 



The OIG seeks to protect the identity of each writer and caller. 



